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Abstract 



The automatic generation of decision trees based on off-line reasoning on models of 
a domain is a reasonable compromise between the advantages of using a model-based ap- 
proach in technical domains and the constraints imposed by embedded applications. In this 
paper we extend the approach to deal with temporal information. We introduce a notion 
of temporal decision tree, which is designed to make use of relevant information as long as 
it is acquired, and we present an algorithm for compiling such trees from a model-based 
reasoning system. 

1. Introduction 

The embedding of software components inside physical systems became widespread in the 
last decades due to the convenience of including electronic control into the systems them- 
selves. This phenomenon occurs in several industrial sectors, ranging from large-scale prod- 
ucts such as cars to much more expensive systems like aircraft and spacecrafts. 

The case of automotive systems is paradigmatic. In fact, the number and complexity 
of vehicle subsystems which are managed by software control increased significantly since 
the mid 80s and will further increase in the next decades (see Foresight- Vehicle, 2002), due 
to the possibility of introducing, at costs that are acceptable for such wide scale products, 
more flexibility in the systems, for e.g. increased performance and safety, and reduced 
emissions. Systems such as fuel injection control, ABS (to prevent blockage of the wheels 
while braking), ASR (to avoid slipping wheels), ESP (controlling the stability of the vehicle), 
would not be possible at feasible costs without electronic control. 

The software modules are usually installed on dedicated Electronic Control Units (ECUs) 
and they play a very important role since they have complete control of a subsystem: hu- 
man "control" becomes simply an input to the control system, together with inputs from 
appropriate sensors. For example, the position of the accelerator pedal is an input to the 
ECU which controls fuel delivery to the injectors. 

A serious problem with these systems is that the software must behave properly also in 
presence of faults and must guarantee high levels of availability and safety for the controlled 
system and for the vehicle. The controlled systems, in fact, are in many cases safety 
critical: the braking system is an obvious example. This means that monitoring the systems 
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behaviour, detecting and isolating failures, performing the appropriate recovery actions is 
a critical task that must be performed by control software. If any problem is detected or 
suspected the software must react, modifying the way the system is controlled, with the 
primary goal of guaranteeing safety and availability. According to recent estimates, about 
75% of the ECU software deals with detecting problems and performing recovery actions, 
that is to the tasks of diagnosis and repair (see again Foresight- Vehicle, 2002). 

Thus the design of the diagnostic software is a very critical and time consuming activ- 
ity, which is currently performed manually by expert engineers who use their knowledge 
to perform the "Failure Mode and Effect Analysis (FMEA)" 1 and define diagnostic and 
recovery strategies. 

The problem is complex and critical per-se, but it is made even more difficult by a 
number of other issues and constraints that have to be taken into account: 

• The resources that are available on-board must be limited, in terms of memory and 
computing power, to keep costs low. This has to be combined with the problem 
that near real time performance is needed, especially in situations that may be safety 
critical. For example, for direct injection fuel delivery systems, where fuel is maintaned 
at a very high pressure (more than 1000 bar) there are cases where the system must 
react to problems within a rotation of the engine (e.g. 15 milliseconds at 4000 rpm), 
to prevent serious damage of the engine and danger to passengers. In fact, a fuel 
leakage can be very dangerous if it comes from a high pressure line. In this case it 
is important to distinguish whether a loss of pressure is due to such a leak, in order 
to activate some emergency action (for example, stop the engine), or to some other 
failure which can simply be signalled to the user. 

• In order to keep costs acceptable for a large scale product, the set of sensors available 
on board is usually limited to those necessary for controlling the systems under their 
correct behaviour; thus, it is not always easy to figure out the impact that faults may 
have on the quantities monitored by the sensors, whose physical, logical and temporal 
relation to faults may be not straightforward. 

• The devices to be diagnosed are complex from the behavioural point of view: they have 
a dynamic and time-varying behaviour; they are embedded in complex systems and 
they interact with other subsystems; in some cases the control system automatically 
compensates deviations from the nominal behaviour. 

These aspects make the design of software modules for control and diagnosis very chal- 
lenging but also very expensive and time consuming. There is then a significant need for 
improving this activity, making it more reliable, complete and efficient through the use of 
automated systems to support and complement the experience of engineers, in order to meet 
the growing standards which are required for monitoring, diagnosis and repair strategies. 

Model-based reasoning (MBR) proved to be an interesting opportunity for automotive 
applications and indeed some applications to real systems have been experimented in the 

1. The result of FMEA is a table which lists, for each possible fault of each component of a system, the 
effect of the faults on the component and on the system as a whole and the possible strategy to detect the 
faults. This table is compiled manually by engineers, based on experience knowledge and on a blueprint 
of the system. 



470 



Temporal Decision Trees: Model-based Diagnosis of Dynamic Systems On-Board 



90s (e.g., Cascio & Sanseverino, 1997; Mosterman, Biswas, & Manders, 1998; Sachenbacher, 
Malik, & Struss, 1998; Sachenbacher, Struss, & Weber, 2000). The type of models adopted 
in MBR are conceptually not too far away from those adopted by engineers. In particular, 
the component oriented approach typical of MBR fits quite well with the problem of dealing 
with several variants of systems, assembled starting from the same set of basic components. 
For a more thorough discussion of the advantages of the MBR approach, see Console and 
Dressier (1999). 

Most of the applications developed so far, however, concentrated on off-board diagnosis, 
that is diagnosis in the workshop, and not on on-board diagnosis. The case of on-board 
systems seems to be more complicated since, due to the restrictions on hardware to be 
put on-board, it is still questionable if diagnostic systems can be designed to reason on 
first-principle models on-board. For this reason other approaches have been developed 
in order to exploit the advantages of MBR also in on-board applications. In particular, 
a compilation-based scheme to the design of on-board diagnostic systems for vehicles was 
experimented in the Vehicle Model Based Diagnosis (VMBD) BRITE-Euram Project (1996- 
99), and applied to a Common-rail fuel injection system (Cascio, Console, Guagliumi, Osella, 
Sottano, & Theseider, 1999). In this approach a model-based diagnostic system is used to 
generate a compact on-board diagnostic system in the form of a decision tree. Similarly, 
automated FMEA reports generated by Model-Based Reasoning in the Autosteve system 
can be used to generate diagnostic decision trees (Price, 1999). Yet similar is the idea 
proposed by Darwiche (1999), where diagnostic rules are generated from a model in order 
to meet resource constraints. 

These approaches have interesting advantages. On the one hand, they share most of 
the benefits of model-based systems, such as relying on a comprehensive representation 
of the system behaviour and a well defined characterization of diagnosis. On the other 
hand, decision trees and other compact representations make sense for representing on- 
board diagnostic strategies, being efficient in space and time. Furthermore, algorithms 
for synthesizing decision trees from examples are well established in the machine learning 
community. In this specific case the examples are the solutions (diagnoses and recovery 
actions) generated by a model-based system. 

However, the basic notion of decision tree and the approaches for learning such trees 
from examples have a major limitation for our kind of applications: they do not cope 
properly with the temporal behaviour of the systems to be diagnosed, and, in particular, 
with the fact that incremental discrimination of possible faults, leading to a final decision 
on an action to be taken on-board, should be based on observations acquired across time, 
thus taking into account temporal patterns. 

For such a reason, in the work described in this paper we introduce a new notion of 
decision tree, the temporal decision tree, which takes into account the temporal dimension, 
and we introduce an algorithm for synthesizing temporal decision trees. 

Temporal decision trees extend traditional decision trees in the fact that nodes have a 
temporal label which specifies when a condition should be checked in order to select one 
of the branches or to make a decision. As we shall see, this allows taking into account 
that in some cases the order and the delay between observable measures influences the 
decision to be made and thus provides important power to improve the decision process. 
Waiting, however, is not always possible and thus the generation of the trees includes a 
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notion of deadline for each possible decision. Thus, the temporal decision process supports 
the possibility of selecting the best decision, exploiting observations and their temporal 
locations (patterns) and taking into account that in some cases at some point a decision 
has to be taken anyway to prevent serious problems. 

The rest of the paper is organized as follows. In section 2 we summarize some basic 
ideas about model-based diagnosis (MBD), the use of decision trees in conjunction with it, 
and the temporal dimension in MBD and in decision trees. In section 3 we provide basic 
formal definitions about decision trees, which form the basis for their extension to temporal 
decision trees in section 4. We then describe (section 5) the problem of synthesizing temporal 
decision trees and our solution (section 6). 

2. Model-based Diagnosis and Decision Trees 

In this section we briefly recall the basic notions of model-based diagnosis and we discuss 
how decision trees can be used for diagnostic purposes, focusing on how they have been 
used in VMBD in conjunction with the model-based approach (Cascio et al., 1999). 

2.1 The Atemporal Case 

First of all let us sketch the atemporal case and the "traditional" use of diagnostic decision 
trees. 

2.1.1 Atemporal model-based diagnosis 

The starting point for model-based diagnosis is a model of the structure and behaviour of 
the device to be diagnosed. More specifically, we assume a component centered approach 
in which: 

• A model is provided for each component type; a component is characterized by 

— A set of variables (with a distinguished set of interface variables); 

— A set of modes, including an ok mode (correct behaviour) and possibly a set of 
fault modes. 

— A set of relations involving component variables and modes, describing the be- 
haviour of the component in such a mode. These relations may model the correct 
behaviour of the device and, in some cases, the behaviour in presence of faults 
(faulty behaviour). 

• A model for the device is given as a list of the component instances and of their 
connections (connections between interface variables). 

In the Artificial Intelligence approach, models are usually qualitative, that is the domain 
of each variable is a finite set of values. Such an abstraction has proven to be useful for 
diagnostic purposes. 

The model can be used for simulating the behaviour of a system and then for computing 
diagnoses. In fact, given a set of observations about the system behaviour, diagnoses can 
be determined after comparing the behaviour predicted by the model (in normal conditions 
or in the presence of single or multiple faults) and the observed behaviour. 
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In order for the model to be useful for on-board diagnosis, for each fault mode F (or 
combination of fault modes) the model must include the recovery action the control software 
should perform in case F occurs. In general these actions have a cost, mainly related to the 
resulting reduction of functionality of the system. Moreover, two actions a\ and ai can be 
related in the following sense: 

• ai, the recovery action associated with fault F±, carries out operations that include 
those performed by ct2, the recovery action associated with F2; 

• a\ can be used as a recovery action also when Fi occurs; it may however carry out 
unneeded operations, thus reducing the system functionality more than strictly nec- 
essary. 

• However, in case we cannot discriminate between F\ and F2, applying a\ is a rational 
choice. 

In section 4.3 we will present a model for actions which formalizes this relation. 

Thus the main goal of the on-board diagnostic procedure is to decide the best action 
to be performed, given the observed malfunction. This type of procedure can be efficiently 
represented using decision trees. 

2.1.2 Decision trees 

Decision trees can be used to implement classification problem solving and thus some form 
of diagnostic procedure. Each node of the tree corresponds to an observable. In on-board 
diagnosis, observables correspond either to direct sensor readings, or to the results of com- 
putations carried out by the ECUs on the available measurements. In the following the 
word "sensor" will denote both types of observables; it is worth pointing out that the latter 
may require some time to be performed. In this paper we mainly assume that a sensor 
reading takes no time; however the apporach we propose deals also with the case in which a 
sensor reading is time consuming, as pointed out in section 5.1. A node can have as many 
descendants as the number of qualitative values associated with the sensor. The leaves of 
the tree correspond to actions that can be performed on board. Thus, given the available 
sensor readings, the tree can be very easily used to make a decision on the recovery action 
to be performed. 

Such decision trees can be generated automatically from a set of examples or cases. 
By example here we mean a possible assignment of values to observables and the corre- 
sponding diagnosis, or possible alternative diagnoses, and a selected recovery action which 
is appropriate for such a set of suspect diagnoses. This set can be produced using a model- 
based diagnostic systems, which, given a set of observables can compute the diagnoses and 
recovery actions. 

In the atemporal case, with finite qualitative domains, the number of possible combina- 
tions of observations is finite, and usually small, therefore considering all cases exhaustively 
(and not just a sample) is feasible and there are two equivalent ways of building such an 
exhaustive set of cases: 

1. Simulation approach: for each fault F, we run the model-based system to predict the 
observations corresponding to F. 
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2. Diagnostic approach: we run a diagnosis engine on combinations (all relevant com- 
binations) of observations, to compute the candidate diagnoses for each one of these 
cases. 

In either case, the resulting decision tree contains the same information as the set of cases; 
if, once sensors are placed in the system, observations have no further cost, the decision 
tree is just a way to save space with respect to a table, and speed up lookup of information. 

In this way the advantages of the model-based approach and of the use of compact deci- 
sion trees can be combined: the model-based engine produces diagnoses based on reusable 
component models and can be used as the diagnoser off-board; compact decision trees, 
synthesized from cases classified by the model-based engine, can be installed on-board. 

2.2 Towards Temporal Decision Trees 

In this section we briefly recall some basic notions on temporal model-based diagnosis (see 
Brusoni, Console, Terenziani, & Theseider Dupre, 1998 for a general discussion on temporal 
diagnosis), and we informally introduce temporal decision trees. 

2.2.1 Temporal MBD 

The basic definition of MBD is conceptually similar to the atemporal case. Let us consider 
the main differences. 

As regards the model of each component type we consider a further type of variable: 
state variables used to model the dynamic behaviour of the component. The set of relations 
describing the behavior of the component (for each mode) is augmented with temporal 
information (constraints); we do not make specific assumptions on the model of time, even 
though, as we shall see in the following, this has an impact on the cases which can be 
considered for the tree generation. As an example, these constraints may specify a delay 
between an input and an output or in the change of state of the component. 

As regards recovery actions, a deadline for performing the action must be specified; this 
represents the maximum time that can elapse between fault detection and the recovery ac- 
tion; this is the amount of time available for the control software to perform discrimination. 
This piece of information is specific to each component instance, rather than component 
type, because the action and the deadline are related to the potential unacceptable effects 
that a fault could have on the overall system; the same fault of the same component type 
could be very dangerous for one instance and tolerable for another. 

Diagnosis is started when observations indicate that the system is not behaving correctly. 
Observations correspond to (possibly qualitative) values of variables across time. In general, 
in the temporal case a diagnosis is an assignment of a mode of behaviour to component 
instances across time such that the observed behaviour is explained by the assignment given 
the model. For details on different ways of defining explanation in this case see Brusoni et 
al. (1998). For the purposes of this paper we are only interested in the fact that, given a 
set of observables, a diagnosis (or a set of candidate diagnoses if no complete discrimination 
is possible) can be computed and a recovery action is determined. 

This means that the starting point of our approach is a table containing the results of 
running the model-based diagnostic system on a set of cases, (almost) independently of the 
model-based diagnostic system used for generating the table. 



474 



Temporal Decision Trees: Model-based Diagnosis of Dynamic Systems On-Board 



We already mentioned that in the static case, with finite qualitative domains, an ex- 
haustive set of cases can be considered. In the temporal case, if the model of time is purely 
qualitative, a table with temporal information cannot be built by prediction, while it can be 
built running the diagnosis engine on a set of cases with quantitative information: diagnoses 
which make qualitative predictions that are inconsistent with the quantitative information 
can be ruled out. Of course, this cannot in general be done exhaustively, even if observa- 
tions are assumed to be acquired at discrete times; if it is not, the decision tree generation 
will actually be learning from examples. 

Thus a simulation approach can only be used in case the temporal constraints in the 
model are precise enough to predict at least partial information on the temporal location 
of the observations, e.g., in case the model includes quantitative temporal constraints. 

The diagnostic approach can be used also in case of weaker (qualitative) temporal con- 
straints in the model. 

As regards the observations, we consider the general case where a set of snapshots is 
available; each snapshot is labelled with the time of observation and reports the value of the 
sensors (observables) at that time. This makes the approach suitable for different notions of 
time in the underlying model and on the observations (see again the discussion in Brusoni 
et al., 1998). 

Example 1 The starting point for generating a temporal decision tree is a table like the 
one in Figure 1. 
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Figure 1: An example of a set of cases for learning temporal decision trees. 

Each row of the table corresponds to a situation (case or "example" in the terminology 
of machine learning) and it reports: 

• For each sensor Sj the values that have been observed at each snapshots (in the example 
we have 8 snapshots, labelled as to 7); n, I, h and v correspond to the qualitative 
values of the sensor measurements; n for normal, I for low, h for high, v for very low 
and z for zero. 

• The recovery action Act to be performed in that situation. 

• The deadline Dl for performing such an action. o 

A table as the one in the above example represents a set of situations that may be 
encountered in case of faults and, as noticed above, it can be generated using either a 
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diagnostic or a simulation approach. In the next section we shall introduce the notion of 
temporal decision trees and show how the pieces of information about sensor histories like 
those in the table above can be exploited in the generation of such trees. 

2.2.2 Introduction to temporal decision trees 

Traditional decision trees do not include a notion of time, i.e., the fact that data may 
be observable at different times or that different faults may be distinguished only by the 
temporal patterns of data. Thus, neglecting the notion of time may lead to limitations in 
the decision process. 

For such a reason in this work we introduce a notion of temporal decision tree. Let us 
analyse the intuition behind temporal decision trees and the decision process they support. 
Formal definitions will be provided later in the paper. 

Let us consider, for example, the fault situations sit3 and sit4 in Figure 1, and let 
us assume, for the sake of simplicity, that the only available sensor is S2- The two fault 
situations have to be distinguished in the control software because they require different 
recovery actions. Both of them can be detected by the fact that S2 shows a low value. 
Moreover, in both situation after a while S2 starts showing a very low value. 

The only way to discriminate these two situations is to make use of temporal information, 
that is to exploit the fact that in sit3 value v shows up after 4 time units from fault detection, 
while in sit4 the same value shows up after 6 time units. 

In order to take into account this in a decision tree, we have to include time into the 
tree. In both examples, the best decision procedure is to wait after observing thst S2 = I 
(that is, after dectecting that a fault has occurred). After 4 time units we can make a 
decision, depending on whether S2 = v or not. This corresponds to the procedure described 
by the tree in Figure 2. 



S2 




Sit4 Sit3 



Figure 2: A simple example of temporal decision tree 

Obviously, waiting is not always the solution or is not always possible. In many cases, in 
fact, safety or other constraints may impose some deadlines for performing recovery actions. 
This has to be reflected in the generation of the decision procedure. Suppose, in the example 
above, that the deadline for sit3 was 3 rather than 6: in this case the two situations would 
have been indistinguishable, beacause it would have been infeasible to wait 4 time units. 
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Thus, an essential idea for generating small decision trees in the temporal case is to 
take advantage of the fact that in some cases there is nothing better than waiting 2 , in order 
to get a good discrimination, provided that safety and integrity of the physical system are 
kept into account, and that deadlines for recovery actions are always met. 

More generally, one should exploit all the information about temporal patterns of ob- 
servables and about deadline, like the ones in Figure 1, to produce an optimal diagnostic 
procedure. 

Another idea we use in our approach is the integration of incremental discrimination, 
which is the basis for the generation and traversal of a decision tree, with the incremental 
acquisition of information across time. 

In the atemporal case, the decision tree should be generated in order to guide the incre- 
mental acquisition of information: different subtrees of a node are relative to different sets 
of faults and therefore may involve different measurements: in a subtree T we perform the 
measurements that are useful for discriminating the faults compatible with the measure- 
ments that made us reach subtree T, starting from the root. For off-board diagnosis, this 
allows reducing the average number of measurements to get to a decision (i.e. the average 
depth of the tree), which is useful because measurements have a cost - e.g. time for an op- 
erator to take them from the system; for on-board diagnosis, even in case all measurements 
are simply sensor readings, which have no cost once the sensor has been made part of the 
system, we are interested in generating small decision trees to save space. 

In the temporal case there is a further issue: the incremental acquisition of information 
is naturally constrained by the flow of time. If we do not want to store sensor values across 
time — which seems a natural choice since we have memory constraints — information must 
be acquired when it is available and it is not possible to read sensors once the choice of 
waiting has been made. This issue will be taken into account in the generation of temporal 
decision trees. 

3. Basic Notions on Decision Trees 

Before moving to a formal definition of temporal decision trees, in this section we briefly 
recall some definitions and algorithms for the atemporal case. In particular, we recall the 
standard ID3 algorithm (Quinlan, 1986), which will be the basis for our algorithm for the 
temporal case. The definitions in this section are the standard ones (see any textbook on 
Artificial Intelligence, e.g., Russel & Norvig, 1995). 

3.1 Decision Trees 

We adopt the following formal definition of decision tree, which will be extended in section 
4.1 to temporal decision trees. 

Definition 1 Let us consider a decision process V where A is the set of available decisions, 
O is the set of tests that can be performed on the external environment, and out(oj) = 

2. A different approach would be that of weighing the amount of elapsed time agains the possibility of 
better discriminating faults; such an approach is something we are considering in the future work on 
temporal decision trees, as outlined in section 7. 
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{v\, ... are the possible outcomes of test Oj G O. A decision tree for V is a labelled 
tree structure T = (r, N, E, C) where: 

• (r, N, E) is a tree structure with root r, set of nodes TV and set of edges E C N x N; 
N is partitioned in a set of internal nodes Ni and a set of leaves Nl ■ 

• C is a labelling function defined over N U E. 

• If n € iVj, £(n) G O; in other words each internal node is labelled with the name of a 
test. 

• If (n, c) € £7 then C((n, c)) € out(£(n)); that is, an edge directed from n to c is 
labelled with a possible outcome of the test associated with n. 

• Moreover, if (n, c\), (n, C2) € £7 and C((n, c\)) = £((n, C2)) then ci = C2, and for each 
v G out(£(n)) there is c such that 

(n, c) G -E and c)) = f ; that is, n has exactly one outgoing edge for each possible 
outcome of test C(n). 

• If Z G Nl, C(l) G A; in other words each leaf is labelled with a decision. o 

When the decision-making agent uses the tree, it starts from the root. Every time it reaches 
an inner node n, the agent performs test C(n), observes its outcome v and follows the v- 
labelled edge. When the agent reaches a leaf /, it makes decision a = C{1). 

3.2 Building Decision Trees 

Figure 3 shows a generic recursive algorithm that can be used to build a decision tree 
starting from a set of Examples and a set of Tests. 

Recursion ends when either the remaining examples do not need further discrimination 
because they all correspond to the same decision, or all available observables have been used, 
and the values observed match cases with different decisions. In the latter case observables 
are not enough for getting to the proper decision and if an agent is actually using the tree, 
it should take into account this. 

In case no terminating condition holds, the algorithm chooses an observable variable 
test to become the root label for subtree T. Depending on how ChooseTest is imple- 
mented we get different specific algorithms and different decision trees. 

A subtree is built for each possible outcome value of test in a recursive call of 
BuildTree, with sets TestsJJpdate and SubExamples as inputs. TestsJJpdate is ob- 
tained by removing test from the set of tests, in order to avoid using it again. SubExamples 
is the subset of Examples containing only those examples that have value as outcome for 
test. 

As mentioned before, there are as many specific algorithms, and, in general, results, as 
there are implementations of ChooseTest. It is in general desirable to generate a tree 
with minimum average depth, for two reasons: 

• Minimizing average depth means minimizing the average number of tests and thus 
speeding up the decision process. 

• In machine learning, a small number of tests also means a higher degree of general- 
ization on the particular examples used in building the tree. 
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1 function BuildTree (set Examples, set Tests) 

2 returns a decision tree T = (root, Nodes, Edges, Labels) 

3 begin 

4 if all ex 6 Examples correspond to the same decision then 

5 return BuiLDLEAF(Examples); 

6 if Tests is empty then 

7 return BuildLeaf (Examples); 

8 test <— CHOOSETEST (Tests, Examples); 

9 root <— new node; 

10 Nodes <— {root}; Edges <— 0; Labels(root) <— test; 

11 T <— (root, Nodes, Edges, Labels); 

12 TestsJJpdate <— Tests \ {test}; 

13 for each possible outcome value of test do begin 

14 SubExamples <— {ex 6 Examples | test has outcome value in ex}; 

15 if SubExamples is not empty then begin 

16 SubTree <— BuildTree (SubExamples, TestsJJpdate); 

17 Append(T, root, SubTree); 

18 Labels((root, RoOT(SubTree))) <- value; 

19 end; 

20 end; 

21 return T; 

22 end. 



Figure 3: Generic algorithm for building a decision tree 

3.3 ID3 

Unfortunately, finding a decision tree with minimum average depth is an intractable prob- 
lem; however, there exists a good best-first heuristic for choosing tests in order to produce 
trees that are "not too deep". This heuristic was proposed in the ID3 algorithm (Quinlan, 
1986), and is base on the concept of entropy from information theory. In the following we 
recall this approach in some detail also in order to introduce some notation which will be 
used in the rest of the paper. 

Definition 2 Given a (discrete) probability distribution P = {pi, . . . ,p n } its entropy £(P) 
is: 

n 

(i) £(P) = -J>iog 2 Pi 

i=l 

O 

Entropy measures the degree of disorder. When we choose a test, we want it to split the 
examples with the lowest degree of disorder with respect to the decisions associated with 
them. 

Given a set of examples IE we introduce the sets: 

E \ a = {e € E | the decision associated with example e is a}. 

If the set of available decisions is A = {a±, . . . , a n } then E | A = {E | , . . . , E \ an } is a parti- 
tion of E. 
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Definition 3 For each ctj G A, i = 1, . . . , n, we define the probability of a« mi/t respect to 
E as follows: 

l( E L )l 

P(a,;E) = ^^ 

o 



It is worth noting that, if examples are endowed with their a priori probabilities, we can 
redefine P(af,E) in order to take them into account. The basic formulation of ID3 assumes 
however that all examples are equiprobable and it computes the probability distribution 
from the frequencies of the examples. 

The entropy of E is: 

n 

(2) £(E) = -J2 log 2 P(ai; E). 

i=i 

If all decisions are equiprobable, we get £(E) = log 2 n, which is the maximum degree of 
disorder for n decisions. If all decisions but one have probability equal to 0, then £(E) = 0: 
the degree of disorder is minimum. 

Entropy is used as follows for test selection. A test o with possible outcomes v\, . . . , Vk, 
splits the set of examples into: 

E | _^. = {e € E | test o has value Vi in e}. 

E | G = {E \ _> V1 , . . . , E \ _> v } is again a partition of E. In particular, if while building the 
tree we choose test o, E \ Q _^ V is the subset of examples we use in building the subtree for 
the child corresponding to Vj. The lowest the degree of disorder in E| _,. , the closer we 
are to a leaf. Therefore, following equation (2): 

n 

£(E \ ^ v . ) = -J2 P (^ E L., ) lo S2 P(ai-,E \ _ Vi ). 

i=l 

Finally, we define the entropy of a test o as the average entropy on its possible outcomes: 



Definition 4 The entropy of a test o with respect to a set of examples E is: 

k 

(3) £(o;E) = y £P(o^v J )£(E\ ^), 

3=1 

u 3 m ^ K E l°-^i )l 

where P(o — > Vj) = — — - — . o 

v 31 |E| 

The ID3 algorithm simply consists of choosing the test with lowest entropy. Figure 4 shows 
the implementation of ChooseTest that yields ID3. 



3. Again, if examples are endowed with a priori probabilities, this definition can be changed in order to 
take them into account 
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13 
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15 



function ID3ChooseTest (set Tests, set Examples) 



returns a test best_test 



begin 

best_test <— any element in Tests; 
min_entropy <— log 2 |Examples|; 
for each test G Tests do begin 



part <— PARTITION({Examples}, test); 



ent <— ENTROPY(part); 



if (ent < min_entropy) then begin 



min_entropy <— ent; 
best_test <— test; 



end; 
end; 

return best_test; 



end. 



Figure 4: ID3 implementation of ChooseTest 



4. Extending Decision Trees 

In this section we formally introduce the notion of temporal decision tree, and we show how 
timing information can be added to the set of examples used in tree building. Moreover we 
introduce a model for recovery action that expresses information needed by the algorithm. 

4.1 Temporal Decision Trees 

In section 2.2.2 we motivated the monotonicity requirement for temporal decision trees, so 
that their traversal requires information relative to increasing time and then no information 
has to be stored. 

We now discuss how temporal information is actually included in the tree and matched 
with temporal information on the observations. The tree has to be used when some abnor- 
mal value is detected for some sensor (fault detection). We then intend the time of fault 
detection as the reference time for temporal labels of observations in the tree. If we look 
for example at the data shown in Figure 1, we see that, for every fault situation, there is 
always at least one sensor whose value at time is different than nnormal. The reason is 
that, for each fault situation, we associate a time label to the first snapshot in which there 
is a sensor showing some deviation from nominal behaviour. 

The following definition provides the extension for the temporal dimension in decision 
trees. 

Definition 5 A temporal decision tree is a decision tree (r, Nj , Nl, E, C) endowed with a 
time-labelling function T such that: 

(1) T : Nj h- > IR + ; we call T(n) a time label] 

(2) if n' G Nj and there exist n such that (n,n') G E (in other words, n' is child of n), 



then T(n') >T(n). 



o 
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Since we assume not to store any information, but rather to use information for travers- 
ing the tree as dictated by the tree itself, a first branching for discrimination is provided 
depending on which is the sensor that provided such a value. We then assume to have 
different temporal decision trees, one for each sensor which could possibly provide the first 
abnormal value, or, alternatively, that the root node has no time label, and the edges from 
the root are not labelled with different values of a single observable, but with different 
sensors which could provide the first abnormal observation. Each tree, or subtree in the 
second alternative, can be generated independently of the other ones, only using the exam- 
ples where the sensor providing fault detection is the same. This generation is what will be 
described in the rest of the paper. 

Let us tree how a temporal decision tree (or forest, in the case of multiple detecting 
sensors) can be exploited by an on-board diagnostic agent in order to choose a recovery 
action. When the first abnormal value is detected, the agent activates a time counter and 
starts visiting the appropriate tree from the root. When it reaches an inner node n, the 
agent retrieves both the associated test s = C(n) and the time label t = T(n). Then it 
waits until the time counter reaches t, performs test s and chooses one of the child nodes 
depending on the outcome. When the agent reaches a leaf, it performs the corresponding 
recovery action. 

With respect to the atemporal case, the agent has now the option to wait. From the 
point of view of the agent it may seem pointless to wait when it could look at sensor values, 
since reading sensor values has no cost. However, from the point of view of the tree things 
are quite different: we do not want to add a test that makes the tree deeper and at the 
same time is not necessary. 

Condition (2) states that the agent can only move forward in time. This corresponds 
to the assumption that sensor readings are not stored, discussed in section 2.2.2. 

Example 2 Let us consider the diagnostic setting described in example 1. Figure 5 shows a 
temporal decision tree for such setting, that is a temporal decision tree that uses the sensors 
and recovery actions mentioned in Figure 1. If such a tree is run on the fault situations in 
the table, a proper recovery action is selected within the deadline. o 

4.2 Adding Timing Information to the Set of Examples 

In order to generate temporal decision trees, we need temporal information in the examples. 
We already introduced informally the notion of a set of examples (or "fault situations") 
with temporal information when describing the table in Figure 1. The following definition 
formalizes the same notion. 

Definition 6 A temporal example-set (te-set for short) E is a collection of fault situations 
siti, . . . ,sit ra characterized by a number of sensors sensi, . . . ,sens m and an ascending se- 
quence of time labels t\ < ... < i| as t representing the instants in time for which sensor 
readings are available. In this context we call observation a pair (senSj,tj). A te-set is 
organized in a table as follows: 

(1) The table has n rows, one for each fault situation. 
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Figure 5: A temporal decision tree for the situations described in Figure 1. 

(2) The table has m x last observation columns containing the outcomes of the different 
observations for each fault situation. We denote by Val(sit^, (senSj, tj}) the value 
measured by sensor senSj at time tj in fault situation sit^. 

(3) The table has a distinguished column Act containing the recovery action associated 
with each fault situation. We denote by Act(sitft) the recovery action associated 
with sitft. 

(4) The table has a second distinguished column Dl containing the deadline for each 
fault situation. We denote by Dl(sit/j) the deadline for sit^, and we have that 
Dl(sith) G {ti, . . . , iiast} f° r each h = l,...,n. We define a global deadline for a 
te-set S as D\(S) = min{DI(sit) | sit G S}. 

We moreover assume that a probability 4 i-*(sit; IE) is associated with each sit G E , such that 
^ siteE P(sit; E) = 1. For every E' C E and for every sit G E' we introduce the following 

notation: P(E'; E) = EsiteE' P ( sit 5 E ) and P ( sit ! E = T§§)- ° 
4.3 A Model for Recovery Actions 

The algorithms we shall introduce require a more detailed model of recovery actions. In 
particular we want to better characterize what happens when it is not possible to uniquely 
identify the most appropriate recovery action. Moreover, we want to quantify the loss we 
incur in when this happens. 

We start with a formal definition: 

Definition 7 A basic model for recovery actions is a triple (A, -<, x) where: 

(1) A = {ai, . . . , ax} is a finite set of symbols denoting basic recovery actions. 

4. P(sit;E) can be computed as a frequency, that is P(sit;E) = 1/n, where n is the number of fault 
situations, or it can be known a priori and added to the set of examples. 
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(2) -<C A x A is a partial strict order relation on A. We say that a« is weaker than 
cij, written as Oj -< aj, if Oj produces more recovery effects than dj, in the sense 
that aj could be used in place of aj (but not the vice versa). We therefore assume 
that there are no drawbacks in actions, that is any action can be performed at any 
time with no negative consequences, apart from the cost of the action itself (see 
below). This is clearly a limitation and something to be tackled in future work (see 
the discussion in section 7). 

(3) x '■ l— *• 1R + is the cost function, and is such that if Oj -< aj then xi a i) < xi a j)- X 
associates a cost with each basic recovery action, expressing possible drawbacks of 
the action itself. Recovery actions performed on-board usually imply a performance 
limitation or the abortion of some ongoing activity; costs are meant to estimate 
monetary losses or inconveniences for the users resulting from these. The require- 
ment of monotonicity with respect to -< stems from the following consideration: if 
aj -< aj and x( a i) > x( a j) it would not make any sense to ever perform Oj, since aj 
could be performed with the same effects at the same (or lower) cost. We moreover 
assume that costs are independent from the fault situation (a consequence of the 
no-drawbacks assumption mentioned in the previous point). o 

Example 3 Let us consider again the four recovery actions a, b, c, d that appear in the te- 
set of Figure 1. Figure 6 shows a basic action model for them. The graph expresses the 
oredering relation -<, while costs are shown next to action names. O 




Figure 6: A basic action model. 

We have seen in the previous section that with each fault situation is associated a 
recovery action; usually this association depends on the fault, but it may also depend on 
the operating conditions in which the fault occurs. 

What happens when we cannot discriminate multiple fault situations? In section 3.2, 
while outlining the generic algorithm for the atemporal case, we referred the solution to the 
decision-making agent. In this case we want to be more precise. 

Definition 8 Let (A, -<,x) be a basic model for recovery actions. We define the function 
merge : 2 A ^ 2 A as follows: 

(4) merge(S') = {ai € S | there is no aj £ S such that ai -< aj} 
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We moreover define: 



(5) 



merge-set(A) = {merge(S') | S G 2 A } C 2 



merge-set(A) is the set of compound recovery actions which includes basic recovery actions 



The intuition behind merge is that when we cannot discriminate multiple fault situations 
we simply merge the corresponding recovery actions. This means that we collect all recovery 
actions, and then remove the unnecessary ones (equation (4)). An action in a set becomes 
unnecessary when the set contains a stronger action. Thus given a te-set E, we define: 



If we take into account compound actions, we can extend the notion of model for recovery 
actions as follows: 

Definition 9 Let A = (A, -<, \) be a basic model for recovery actions. An extended model 
for A is a triple (A, -< e xt,Xext) where: 

(1) ~W±! merge-set(A) x merge-set(A) and given A, A' G merge-set(A), A -< e xt A' if 
for every a G A either a G A' or there exists a' G A' such that a < a! . Notice that 
{<2j} ^ext {a-j} if and only if a-i -< aj. 

(2) Xext : merge-set(A) i— > IR + is a cost function over compound actions such that for 
every A G merge-set(A), m&x aeA x(a) < Xext(A) < Y^aeA- Moreover, if A -< ext A' 
then it must hold that Xext(A) < Xext(A'). 

While -<ext is uniquely determined by -<, the same does not hold for Xext- for this rea- 
son there is more than one extended model for any basic model. The requirement that 
max ag AX(°0 < Xext(A) is motivated as follows: if there existed a £ A such that Xext(A) < 
x(a) then it would make sense never to perform a, substituting it for A. In fact, {a} -< e *t A 
and A would have the same or lower cost. We also ask Xext - as we did for basic models - 
to be monotonic with respect to -< e xt- 

In the following we shall consider only extended models for recovery actions, thus we 
shall drop the ext prefix from both -< and \- 

Example 4 Figure 7 shows a possible extension for the basic model in Figure 6. In this 
case the cost of the compound action {b, c} is given by the sum of the individual costs of b 
and c. o 

5. The Problem of Building Temporal Decision Trees 

In this section we outline the peculiarities of building temporal decision trees, showing the 
differences with respect to the "traditional" case. 



in the form of singletons. 



O 



(6) 



Act(E) = merge({Act(sit) | sit G E}). 
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{a} - x- 100 
{b,c}- X - 70 



{b} - x- 20 



• {c}- X - 50 
{d} - x- 10 



Figure 7: An extended action model. 



5.1 The Challenge of Temporal Decision Trees 

What makes the generation of temporal decision trees more difficult from standard ones is 
the requirement that time labels do not decrease when moving from the root to the leaves: 
this corresponds to assuming that sensor values cannot be stored; when the decision-making 
agent decides to wait it gives up using all values that sensors show while it is waiting. 

If we release this restriction we can actually generate temporal decision trees with a 
minor variation of ID3, essentially by considering each pair formed by a sensor and a time 
label as an individual test. In other words ID3ChooseTest selects a sensor s and a time 
label t such that reading s at time t allows for the maximum discrimination among examples. 

However in systems as the ones we are considering, that is low-memory real-time systems, 
the possibility of performing the diagnostic task without discarding dynamics but also 
without having to store sensor values across time is a serious issue to take into account. 
For this reason the definition of temporal decision tree includes the requirement that time 
labels be not decreasing on root-leaf paths. 

Figure 8 shows a generic algorithm for building temporal decision trees that can help us 
outline the difficulties of the task. Line 8 shows a minor modification aimed at taking into 
account deadlines: an observation can be used on a given set of examples only if its time 
label does not exceed its global deadline. Violating this condition would result in a tree 
that selects a recovery action only after the deadline for the corresponding fault situation 
has expired. 

The major change with respect to the standard algorithm is however shown in line 
15: once we select an observation pair (sensor, tlabel) we must remove from the set of 
observations all those pairs whose time label is lower than tlabel 5 . 

As a consequence of these operations - ruling out invalid observations and discarding 
those that are in the past - the set of observations available when building a child node can 
be different from the one used for its parent in more than one way: 

5. Actually this assumes that reading a sensor and moving downwards the tree accordingly can be done 
so swiftly that the qualitative sensor values have no time to change in the meanwhile. If this is not the 
case, one can choose to remove also the pairs with time labels equal to tlabel, or more generally those 
with time labels lower than tlabel + k where k is the time needed by the diagnostic agent to carry out 
tree operations. For the sake of simplicity, however, in the following we will assume that k is 0, since the 
choice of k does not affect the approach we propose. 



486 



Temporal Decision Trees: Model-based Diagnosis of Dynamic Systems On-Board 



1 function BuildTemporalTr.ee (te-set Examples, set Qbs, action model ActModel) 

2 returns a temporal decision tree T = (root, Nodes, Edges, Labels, TLabels) 

3 begin 

4 if for all sit G Examples Act(sit) is the same then 

5 return BuiLDLEAF(Examples, ActModel); 

6 deadline <— DI(Examples); 

7 UsefulObs <— {o G Obs | 3sl, s2 G Examples s.t. Val(sl, o) / Val(s2, o)}; 

8 ValidObs <— {{sensor, tlabel) G UsefulObs | tlabel < deadline}; 

9 if ValidObs is empty then 

10 return BuildLeAF (Examples, ActModel); 

11 (sensor, tlabel) <— ChOOSeObS (ValidObs, Examples, ActModel); 

12 root <— new node; 

13 Nodes <— {root}; Edges <— 0; Labels(root) <— sensor; TLabels(root) <— tlabel; 

14 T <— (root, Nodes, Edges, Labels, TLabels); 

15 ObsJJpdate <— {(sens,tst) G UsefulObs | tst > tlabel}; 

16 for each possible measure value of sensor do begin 

17 SubExamples <— {sit G Examples | Val(sit, (sensor, tlabel)) = value}; 

18 if SubExamples is not empty then begin 

19 SubTree <— BuildTempORAlTree (SubExamples, ObsJJpdate, ActModel); 

20 Append(T, root, SubTree); 

21 Labels((root, RoOT(SubTree))) <— value; 

22 end; 

23 end; 

24 return T; 

25 end. 

26 function BuildLeaf (te-set Examples, action model ActModel) 

27 returns a loose temporal decision tree T = (leaf, {leaf}, 0, Labels, 0) 

28 begin 

29 all.act <— {Act(sit) | sit G Examples}; 

30 comp_act <— merge(all_act); 

31 leaf <— new node; Labels(leaf) <— comp_act; T <— (leaf , {leaf }, 0, Labels, 0); 

32 return T; 

33 end. 



Figure 8: Generic algorithm for building a temporal decision tree 

• Some observations can be invalid for the parent and valid for the child. The recursive 
call for the child works on a smaller set of examples; therefore the global deadline may 
be further ahead in time, allowing more observations to be used. 

• Some observations can become unavailable for the child because they have a time 
label lower than that used for the parent. 

Of course the problematic issue is the latter: some observations are lost, and among them 
there may be some information which is necessary for properly selecting a recovery action. 

Let us consider as an example the te-set in Figure 9, with four fault situations, two time 
labels (0 and 1) and only one sensor (s). Each fault situation is characterized by a different 
recovery action, and the te-set obviously allows to discriminate all of them. However the 
entropy criterion would first select the observation {s, 1), which is more discriminating. 



487 



Console, Picardi, & Theseider Dupre 





(8,0) 




Act 


siti 


X 


X 


a 


sit 2 


X 


y 


b 


sit 3 


y 


y 


c 


sit 4 


y 


z 


d 



Figure 9: A te-set causing some problems to standard ID3 algorithm if used for temporal 
decision trees. 



The observation {s, 0) would then become unavailable, and the resulting tree could never 
discriminate sit2 and sit3 . 

This shows that there is a relevant difference between building standard decision trees 
and building temporal decision trees. Let us look again at the generic algorithm for standard 
decision trees presented in Figure 3: the particular strategy implemented in ChooseTest 
does not affect the capability of the tree of selecting the proper recovery action, but only the 
size of the tree. Essentially the tree contains the same information as the set of examples - 
at least for what concerns the association between observations and recovery actions. We 
can say that the tree has always the same discriminating power as the set of examples, 
meaning that the only case when the tree is not capable of deciding between two recovery 
actions is when the set of examples contains two fault situations with identical observations 
and different actions. 

If we consider the algorithm in Figure 8 we see that the order in which observations are 
selected - that is, the particular implementation of ChooseObs - can affect the discrimi- 
nating power of the tree, and not only its size. Since from one recursive call to the following 
some observations are discarded, we can obtain a tree with less discriminating information 
than the original set of examples. Our primary task is then to avoid such a situation, that is 
to build a tree which is small, but which does not sacrifice relevant information. As a con- 
sequence, we cannot exploit the strategy of simply selecting an observation with minimum 
entropy. 

In the next sections we shall formalize the new requirements for the output tree, and 
propose an implementation of ChooseObs which meets them. 

5.2 Each Tree Has a Cost 

In the previous section we informally introduced the notion of discriminating power. In 
this section we shall introduce a more general notion of expected cost of a temporal decision 
tree. Intuitively, the expected cost associated with a temporal decision tree is the expected 
cost of a recovery action selected by the tree, with respect to the probability distribution 
of the fault situations. 

Expected cost is a stronger notion than discriminating power: on the one hand if a tree 
discriminates better than another, than it has also a lower expected cost (we shall soon 
prove this statement). On the other hand expected cost adds something to the notion of 
discriminating power, since any two trees are comparable from the point of view of cost, 
while they may not be from the point of view of the discrimination they carry out. 
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Before defining expected cost, we need to introduce some preliminary definitions. 

We shall make use of a function, named examples, that given an initial set of examples 
IE and a tree T associates to each node of the tree a subset of E. To understand the meaning 
of such a function before formally defining it, let us imagine to run the tree on E and at 
a certain point of the decision process to reach a node n: examples tells us which is the 
subset of fault situations which we have not yet discarded. 

Definition 10 Let E be a te-set with sensors Si, . . . , s m} time labels £1, . . . , iiast and actions 
model (A, ~<,x)- Moreover let T = (r, N, E, C,T) be a temporal decision tree such that 
for every internal node n £ N we have C{n) £ {s±, . . . , s m } and T(n) £ {t±, . . . , i| as t}- We 
define a function examples(-; E) : N i-> 2 E as follows: 

(7) examples(r; E) = E where r is the root of T; 

examples(n; E) = {sit £ examples(p; E) | Val(sit, (C(p),T(p))) = C((p,n))} 

where n £ N, n / r and (p, n) £ E. 

examples is well defined since for any n £ N different from the root there exists exactly 
one p £ N such that (p, n) £ E. o 

Notice that, if E is the set of examples used for building T, examples(n; E) corresponds to 
the subset of examples used while creating node n. 

Example 5 Let us consider Figure 10: it shows the same tree as Figure 5, but for every 
node n we can also see the set of fault situations examples(n; E), where E is the te-set of 
Figure 1. o 
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Figure 10: A temporal decision tree showing the value of example(n, E). 
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In the following when using function examples we shall omit the second argument, 
denoting the initial te-set, when there is no ambiguity about which te-set is considered. 

Not every tree can be used on a given set of examples: actually we need some compati- 
bility between the two, which is characterized by the following definition. 

Definition 11 Let E be as in previous definition. We say that a temporal decision tree 
T = (r, N, E, C, T) is compatible with E if: 

• For every internal node n G N, C(n) G {s±, . . . , s m }, T(n) G {t±, . . . , t\ ast } and T(n) < 
DI(examples(n;E)). 

• For every leaf / G N, C(l) G merge(A) and C(l) = merge(Act(examples(7; E))). 

It is straightforward to see that a tree is compatible with the set of examples used in building 
it. 

We have the following property 6 : 

Proposition 12 Let T = (r, N, E, C,T) be a temporal decision tree compatible with a te- 
set E. Let Zi, . . . ,lf G N denote the leaves ofT. Then examples(/i), . . . , examples(Zj) is a 
partition o/E. 

For each sit G E we then denote by leafr(sit) the unique leaf I of T such that sit G 
examples(/). We are now ready to formalize the notion of discriminating power. 

Definition 13 Let T = (r T , iV T , Et, £t, Tt), U = (r\j, N\j, E\j, C\j, Tjj) denote two tem- 
poral decision trees compatible with the same te-set E. Let moreover (A, -<,x) be the 
recovery action model used in building T and U. We say that T is more discriminating 
than U with respect to E if: 

(1) for every sit G E either £ T (leaf T (sit)) -< C\j (leaf u (sit)) or Ct (leaf T (sit)) = 
£u (leaf u (sit)); 

(2) there exists sit G E such that Ct (leaf T (sit)) -< £u(leafu(sit)). o 

Notice that the second condition makes sure that the two trees are not equal (in which 
case they would be equally discriminating), something that the first condition alone cannot 
guarantee. 

Example 6 Let us consider the tree in Figure 10 above and the tree in Figure 11 below. 
The former is more discriminating than the latter. In fact, the two trees associate the same 
actions to siti, sit2, sit3, sit4, sits and s\t§. However the former associates action b with sit-? 
and action c with sit§, while the latter associates to both s\tj and sits the compound action 
{b,c}. o 

Unfortunately we cannot easily use discriminating power - as defined above - as a pref- 
erence criterion for decision trees. The reason is that it does not define a total order on 
decision trees, but only a partial one. The following situations may arise: 

6. For the sake of readability, all proofs are collected in a separate appendix at the end of the paper. 
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• For some sit, £T('eaf T (sit)) -< £u(leafu(sit)); for some other sit, £u(' ea fu(sit)) -< 
£ T (leaf T (sit)). 

• For a given sit, £T(leaf T (sit)) -fi £u('eafu(sit)), nor £u('eafu(sit)) -fc £t (leaf T (sit)). 

From the point of view of discriminating power alone, it is reasonable for T and U not to be 
comparable in the above cases. Nonetheless, there may be a reason for preferring one over 
the other, and this reason is cost. For example if we consider the second situation, even if 
C^is'it) and £u( s 't) are not directly comparable from the point of view of their strength, 
one of the two may be cheaper than the other and thus preferable. 
We therefore introduce the notion of expected cost of a tree. 

Definition 14 Let T = (r, N, E, C, T) be a temporal decision tree compatible with a te- 
set E and an action model A = (A, -<,x)- We inductively define an expected cost function 
Xea'-N>—> ]R + on tree nodes as follows: 



(8) X K , A (n) = < 



X(£(0) if I G N is a leaf; 

y~] P{C{n) — > £((n, c))) • Xe,a(c) if n £ N is an inner node. 

c:(n,c)£E 



where P(C(n) - 
and is given by: 



P(C(n)^C((n,c))) 



C((n, c))) is the probability of sensor C{n) showing a value v = £((n, c)) 
P(examples(c);E) 



P(examples(c); examples(n)). 



P(examples(n); E) 

The expected cost ofT with respect to E and A, denoted by Xe,a(T^) , is then defined as: 
(9) * e ,a(T) = Af E)A (r) where r is the root of T 



o 



The above definition states that: 

• The expected cost of a tree leaf I is simply the cost of its recovery action £(l); 

• The expected cost of an inner node n is given by the weighted sum of its children's 
expected costs; weight for child c is given by the probability P{C{n) — > £((n, c))). 

• The expected cost of a temporal decision tree T is the expected cost of its root. 

The following proposition states that the weighted sum for computing the expected cost 
of the root can be performed directly on tree leaves. 

Proposition 15 Let T = (r, N, E, C, T) denote a temporal decision tree, and let l\, . . . ,l u 
be its leaves. Then 

u 

(10) *e,a(T) = £ • P(examples(0; E) 

i=l 
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very low 



(s 2 ,0> 

sit 1( sit 2 ,sit 3 ,sit 4 
sit 5 ,sit 6 ,sit 7 ,sit g 



low 



very low ( s 2' 5 ) 
sit i 
sit 6 





Figure 11: A temporal decision tree less discriminating than the one in Figure 10. 

The next proposition shows that expected cost is monotonic with respect to the "better 
discrimination" relation, and therefore it is a good preference criterion for temporal decision 
trees, since a tree with the lowest possible expected cost is the most discriminating one, 
and moreover it is the cheapest among equally discriminating trees. 

Proposition 16 Let T = (r?, Nt, Et, £t,Tt) , U = (rjj, Njj, Ejj, Cjj, Tjj) be two tempo- 
ral decision trees compatible with the same te-setK and the same actions model A. IfT is 
more discriminating than U then Xe,a(T) < ^e,a(U). 



Example 7 Let us compute the expected cost of tree T\ in Figure 10 and of tree T 2 in 
Figure 11, with respect to the te-set E in Figure 1 and the action model A in Figure 7. We 
shall assume that all fault situations are equiprobable, that is each of them has probability 
1/8. By exploiting proposition 15 we obtain: 

#e,a(Ti) = P(siti)x(a) + P(sit 7 )x(&) + P(s\t 6 ) X (d) + P(sit 3 )x(6) + P(sit 4 )x(c) + 
+P({sit 2 ,sit 5 })x({fo,c}) +P(sitg)x(c) = 

= I- 100 + i • 20+ i • 10 + i .20 + ^-50+ J .70+^-50 = 
= 12.5 + 2.5 + 1.25 + 2.5 + 6.25 + 17.5 + 6.25 = 48.75 
*e,a( t 2) = P(siti)x(a) + P(sit 6 )x(d) + P(sits)x(6) + P(sit 4 )x(c) + 
+P({sit 2 , sit 5 , sit 7 , sit 8 })x({&, c}) = 

= - • 100 + - • 10 + - • 20 + - • 50 + - • 70 = 

8 8 8 8 2 

= 12.5 + 1.25 + 2.5 + 6.25 + 35 = 57.5 
We can see that the less discriminating tree, that is T 2 , has a higher expected cost. o 

5.3 Restating the Problem 

In the previous section we introduced expected cost as a preference criterion for decision 
trees. Given this notion, we can restate the problem of building temporal decision tree as 
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that of building a tree with minimum possible expected cost. This section formally shows 
that the notion of "minimum possible expected cost" is well defined, and more precisely 
it corresponds to the cost of a tree that exploits all observations in the te-set. The goal 
can then be expressed as finding a reasonably small tree among those whose expected cost 
is minimum. 

In this section, as well as formalizing the above mentioned notions, we introduce some 
formal machinery that will be useful in proving the correctness of our algorithm. 

Definition 17 Let IE denote a te-set. Moreover, let t\, . . . ,t\ ast denote the time labels of 
E. We say that siti,sitj E E are pairwise indistinguishable, and we write sitj ~ sitj, if 
for all ti < min{DI(sitj), Dl(sitj)} and for all sensors s we have that Val(sitj, (s, U)) = 
VaKsitj, (s,U)). o 

As a relation, ~ is obviously reflexive and symmetric, but it is not transitive. If we consider 
a sitfc with a particularly strict deadline, it might well be that sit; ~ sit&, sitfc ~ sitj, but 
sitj oo sitj. We now introduce a new relation w which is the transitive closure of ~. 

Definition 18 Let E denote a te-set. We say that sit j, sit,- € E are indistinguishable, and 
we write sitj « sitj, if there exists a finite sequence sitj^, . . . , sitfc u € E such that 

• sit fcl = sit;; 

• s\t ku = S\tj, 

• for every g=l,...,u-l, s\t kg ~ sit fcg+1 . o 

pa is an equivalence relation over E, and we denote by E/sa the corresponding quotient set. 
We have the following definition: 

Definition 19 Let E be a te-set, with actions model A. The expected cost of E, denoted 
by .V a - is defined as: 

(11) T,. A = x(merge({Act(sit) | sit e v })) ■ P(r?;E) 

o 

Example 8 Let us consider the te-set E in Figure 1 and the action model A in Figure 7. 
The only two indistinguishable fault situations in E are sit2 and sits. Thus we have: 

A 7 a = ^(siti)x(a) + P({sit 2 , sit 5 })x({k, c}) + P(sits)x(&) + P(sit 4 )x(c) + 
+P(sit 6 )x(d) +P(sit 7 ) x (6) +P(sit 8 ) X (c) = 

= - • 100 + \ ■ 70 + - • 20 + - • 50 + - • 10 + - • 20 + - • 50 = 

8 4 8 8 8 8 8 

= 12.5 + 17.5 + 2.5 + 6.25 + 1.25 + 2.5 + 6.25 = 48.75 

Notice that the tree in Figure 10 has the same cost as the te-set, thus its cost is the minimum 
possible, as we show below. Of course we may still be able to build another smaller tree with 
the same cost. o 
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Now we need to show that Xe,a is actually the minimum possible expected cost for a 
temporal decision tree compatible with E. 

Theorem 20 Let E be a te-set with actions model A. We have that: 

(i) There exists a decision tree T compatible with E such that «Ye,a(T) = %e,a- 

(ii) For every temporal decision tree T compatible with E, .V -.a < <^e,a(T). O 

Now we can state more precisely the problem of building a temporal decision tree: 

Given a te-set E with actions model A, we want to build a temporal decision 
tree T over E, such that A?e,a(T) = .V -.a • Moreover, we want to keep the tree 
reasonably small by exploiting entropy. 

6. The Algorithm 

In this section we describe in detail our proposal for building temporal decision trees from a 
given te-set and action model. We also discuss the complexity of the algorithm we introduce, 
and give an example of how the algorithm works. 

6.1 Preconditions 

Our goal is now to define an implementation of function ChooseObs such that, once 
plugged into function BuildTemporalTree, yields a solution to the problem of building 
temporal decision trees as stated in section 5.3. First however we shall analyze some prop- 
erties of BuildTemporalTree as defined in Figure 8: this will lead us smoothly to the 
solution and will help us prove formally its correctness. In order to accomplish this task we 
need to introduce some notation that allows us to speak about algorithm properties. 

Let E be a te-set with fault situations {siti, . . . , sit n }, sensors {s\, . . . , s m }, time labels 
{ii, . . . , tiast} and action model A. We aim at computing our tree T by executing: 

(12) T <— BuiLDTEMPORALTREE({siti, . . . ,sit n }, {si, . . . , S m } X {ti, . . . ,t|ast}> A ) 

Each execution of BuildTemporalTree comprises several recursive calls to the same 
function; given two recursive calls c, d we shall write c C d when c occurs immediately 
inside d . Moreover we shall denote by cq the initial call. Finally, we shall call terminal a 
recursive call which does not have any further inner call. 

For a given call c, we shall denote by [[Example]] c , [[Obs]] c , [[ActModel]] c the actual values 
of the formal parameters in c. With a slight abuse of notation, we shall also write [[var]] c 
to denote the value of those variables var in c that, once set, never change their value 
(deadline, UsefulObs, ValidObs, sensor, tlabel, ObsJJpdate). Finally, we shall denote 
by [[T]] c the tree returned by call c. 

Each recursive call c works on a different te-set, which is defined by [[Examples]] c 
and [[Obs]] c . The actions model however is always the same, since for c C d we have 
[[ActModel]] c = [[ActModel]] c /. We shall denote by E c the te-set used in call c, which is 
determined by its input parameters. 
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The following proposition is critical for proving the correctness of our approach. It 
states that we can obtain a tree with minimum expected cost if and only if we guarantee 
that there is no increase in the expected cost of the te-set when passing from the set of 
observations Obs to the set ObsJJpdate: 

Proposition 21 Let us consider an execution of BuildTemporalTree starting with a 
main call cq. The initial te-set, which we want to build a tree over, is E = E co with 
A = [[ActModel]] C() . For any recursive call c, let us denote by E* the te-set determined by 
[[Examples]] c and [[Obs_Update]] c . Then: 

(1) ^e,a([[T]] C() )>^e,a 

(2) <Ye,a([T]]co) = .V ..a if and only if for every non terminal 7 recursive call c generated 
by co it holds that Xe c ,a = <^e*,a 

6.2 Implementing ChooseObs 

Proposition 21 suggests that we need to provide an implementation for ChooseObs such 
that at each recursive call c, Xy. c ,a = ^e*,a- Let us examine in more detail the relations 
between [[Obs]] c and [[Obs_Update]] c . 

As a first step, [[Usef ulObs]] c is obtained by removing from [[ObsJ c those observations 
that do not help in discriminating fault situations. This has no effect on the expected cost 
of the te-set, since it does not affect the relation of indistinguishability. 

Then [[Obs_Update]] c is obtained from [[Usef ulObs]] c by removing those observations 
whose time label precedes the chosen one. The expected cost of the resulting te-set thus 
depends on the time label selected by function ChooseObs. We have the following prop- 
erties: 

Proposition 22 Let c, d denote two independent calls to BuildTemporalTree with the 
same input arguments but with different implementations of ChooseObs. If [[tlabel]] c < 
[tlabelfld then X . . A < X . ; . A . 

Proposition 23 Let c be a call to BuildTemporalTree. If [[tlabel]] c = i m j nc = min{t | 
(t,s) £ [[ValidObs]] c } then X^*, a < #e c ,a- 

Now we define the notion of a safe time label: 

Definition 24 Let c denote a call to BuildTemporalTree. A time label t is said to be 
safe with respect to c if [[tlabel]] c = t implies X . a = ^e^a- 

An immediate consequence of propositions 22 and 23 is the following: 

Proposition 25 For any call c to BuildTemporalTree there exist a time label t maXc 
such that the safe time labels are all and only those t with t m \ nc < t < 

tmax c j where t m \ nc is 

as in proposition 23. 

7. We exclude terminal calls because they do not even compute ObsJJpdate. 
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Figure 12 describes ID3ChooseSafeObs, the implementation of ChooseObs we pro- 
pose. It exploits the properties we have proved in this and the previous section in order to 
achieve the desired task in an efficient way. Let us examine it in more detail. 

ID3ChooseSafeObs (Figure 12) computes the set of safe observations (line 4) and 
then chooses among them one with minimum entropy (line 5). For what we have proved 
up to now, such an implementation yields a temporal decision tree with minimum expected 
cost, and at the same time exploits entropy in order to keep the tree small. 

Let us now see how FindSafeObs (also in Figure 12) computes the set of safe obser- 
vations. Proposition 23 shows that the notion of safeness is tied to time labels rather than 
to individual observations. First of all FindSafeObs determines the range of valid time 
labels for the current set of examples (line 12); the lower bound i| ow is the lowest time label 
in Dbs, and is stored in variable t_low, while the upper bound t up is given by the global 
deadline for Examples, and is stored in variable t_up. 

Then the idea is to find the maximum safe label t max (variable t_max) which allows us 
to easily build the set of safe observations (line 21). 

In order to accomplish this task the following steps have to be performed: 

• Given the initial te-set E, defined by Examples, Obs and ActModel, compute Xe,a- 

• For each time label t in the range delimited by t\ QW and t up , consider the te-set Ej 
defined by Examples and by those observations with time label equal or greater than 
t. Then compute ^E t ,A- 

• As soon as we find a time label t with %E t ,A > <^e,a, we know that i max is the time 
label immediately preceding t. 

Here the most critical operation (in terms of efficiency) is that of computing the expected 
cost of each E t , because this involves finding the quotient set Et/«. In fact, in order 
to obtain the quotient set, we need to repeatedly partition the te-set with respect to all 
observations available for it. 

QuotientSet function (Figure 12) performs precisely this task. It takes in input the 
current time label tlabel, an initial partition (possibly made of a single block with the 
entire te-set) and the set of all observations, from which it will select valid ones. 

First of all it partitions the input te-set with respect to observations with the current 
time label (lines 28-31). Then it executes iteratively the following operations: 

• For each partition block it checks whether the deadline has moved further in time 
(lines 36-38). 

• If so, it partitions again the block and stores the resulting sub-blocks for further 
examination (lines 39-41). 

• If not, the block is part of the Final partition that will be returned (line 42). 

In order to simplify the task, we introduce as a data type the extended partition, where each 
partition block is stored together with the highest time label used in building it. In this way 
we can easily check if the deadline for the block allows us to exploit more observations or 
not. Using extended partitions instead of standard ones we need to define a new function, 
ExtPartition, which works in the same way as the Partition function used in Figure 4, 
but also records with each block the highest time label used for it. 
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1 function ID3ChooseSafeObs (set Obs, te-set Examples, action model ActModel) 

2 returns an observation o = (sensor, tlabel) 

3 begin 

4 SafeObs <— FlNDSAFEOBS(0bs, Examples, ActModel); 

5 o <— ID3CHOOSETEST(Saf eObs, Examples); 

6 return o; 

7 end. 

8 function FindSafeObs (set Obs, te-set Examples, action model ActModel) 

9 returns a set of observations SafeObs 

10 begin 

11 cost <— y .„„ . Act(sit); 

^— 'sitGExamples V -" 

12 t_up <— DI(Examples); t_low <— min{t | (s,t) G Obs}; 

13 t_max <— t_up; part <— {(Examples, t_up)}; 

14 for every time label tx starting from t_up down to t_low do begin 

15 part <— QuOTIENTSET(part, Obs, tx); 

16 newcost <— ExPECTEDCoST(part); 

17 if newcost < cost then begin 

18 cost <— newcost; t_max <— tx; 

19 end; 

20 end; 

21 SafeObs <- {(s, t) | t < t_max}; 

22 return SafeObs; 

23 end. 

24 function QuotientSet (partition Initial, set Obs, time label tlabel) 

25 returns a refined partition Final 

26 begin 

27 part <— Initial; 

28 for all (s,t) with t = tlabel do begin 

29 part <— ExtPartitiON (par t , (s,t)); 

30 ObsCurr <- ObsCurr U {(s,t)}; 

31 end; 

32 Final <- 0; 

33 while part ^ do 

34 tmp_part <— 0; 

35 for each (block, ty) 6 part do begin 

36 newdl <- Dl (block); 

37 single <— {(block, ty)}; 

38 if newdl > ty then begin 

39 for each (s,t) with ty < t < newdl do 

40 single <— ExTPARTITION(single, (s,t)); 

41 tmp_part <— tmp_part U single; 

42 end else Final <— Final U start; 

43 end; 

44 part <— tmp_part; 

45 end; 

46 return Final; 

47 end. 



Figure 12: ID3ChooseSafeObs is an implementation of ChooseObs yielding a tree with 
minimum expected cost 
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Notice that QuotientSet needs the whole set of observations (and not only valid ones) 
to properly compute the result; therefore when BuildTemporalTree calls ID3ChooseSafeObs 
it must pass as first argument UsefulObs instead of ValidObs. 

FindSafeObs exploits QuotientSet to find all quotient sets for all E t , but does so 
using an efficient approach which we call backward strategy. 

First of all, we can notice that the order in which observations are considered does not 
matter while building a quotient set. Moreover, if t < t' , E</~ is a refinement of E t //~; in 
other words we can obtain it from E 4 //~ by simply refining the partition with additional 
observations. 

Thus, we can compute all quotient sets at the same time as we compute E/ss. 

FindSafeObs does exactly so: it computes all quotient sets and their expected cost 
starting from the last time label i up . Each quotient set is not built from scratch, but as a 
refinement of the previous one. This is the reason why QuotientSet (and ExtPartition 
as well) takes as first argument not a single set, but a partition. In this way, all quotient sets 
are computed with the same operations 8 needed to build E/«. The next section analyzes 
in further detail complexity issues. 

6.3 Complexity 

In this section we aim at showing that the additional computations needed in building 
temporal decision trees do not lead to a higher asymptotical complexity than that we 
would get by using the standard ID3 algorithm on the same set of examples (we discussed 
in section 5.1 the circumstances that could make such an approach feasible). 

Essentially the difference between the two cases lies in the presence of FindSafe- 
Obs function. Wherever BuildTree calls ID3ChooseTest, BuildTemporalTree calls 
ID3ChooseSafeObs, which in turn calls both FindSafeObs and ID3ChooseTest. 

Let us compare FindSafeObs and ID3ChooseTest, which are similar in many ways. 
The former repeatedly partitions the input te-set with respect to every available observation; 
then it computes entropy for each partition built in such a way. FindSafeObs builds 
just one partition by exploiting all available observations; in other words instead of using 
each observation to partition the initial te-set, it exploits it in order to refine an existing 
partition of the same te-set. Moreover, at each time label it computes the expected cost 
of the partition built so far. Essentially, if we denote by N$ the number of sensors and 
with Nt the number of time labels in the initial partition, we have roughly the following 
comparison: 

• Ns x Nt (number of observations) entropy computations for ID3ChooseTest vs. 
Nt expected cost computations for FindSafeObs. 

• JVjx Nt partitions of the initial te-set for ID3ChooseTest vs. Ns x Nt refinements 
of existing partitions of the initial te-set for FindSafeObs. 

Entropy and expected cost can be computed with roughly the same effort: both require 
retrieving some information for each element of each partition block, and to combine this 
information in some quite straightforward way. The complexity of this task depends only 
on the overall number of elements, and not on how they are distributed between different 

8. There is a slight overhead due to the need to find which observations should be used at each step. 
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block of the partition. So even if expected cost is computed most of the times on finer 
partitions than entropy, the only thing that matters is that both are partitions of the same 
set, thus involving the same elements. 

Now let us examine the problem of creating a partition. This involves retrieving a value 
for each element of each block of the initial partition (which again depends only on the 
number of elements, and not on the number of blocks of the initial partition) and to properly 
assign the element to a new partition block depending on the original block and on the new 
value. The main difference in this case between starting with the whole te-set (creation) or 
with an initial partition (refinement), is the size of the new blocks that are being created, 
which are smaller in the second case. Dependent on how we implement the partition data 
type, this may make no difference, or may take less time for the refinement case. However, 
it never happens that refinement (corresponding to FindSafeObs function) requires more 
time than the creation (corresponding to ID3ChooseTest function) of a partition. 

Therefore we can claim that FindSafeObs function has the same asymptotic complex- 
ity as function ID3ChooseTest. Thus also ID3ChooseSafeObs has the same asymp- 
totic complexity as ID3ChooseTest, and we can conclude that BuildTree has the same 
asymptotic complexity as BuildTemporalTree. 

6.4 An Example 

In this section we shall show how our algorithm operates on the te-set in Figure 1 with 
respect to the action model in Figure 7. 

Let us summarize the information the algorithm receives. Eight fault situations are 
involved; moreover we can exploit three sensors, each of which can show five different 
qualitative values: h - high, n - normal, I - low, v - very low, z - zero. Time labels 
correspond to natural numbers ranging from to 7, and we assume they correspond to 
times measured by an internal clock which is started at the time of fault detection. There 
are four basic recovery actions a, b, c, d, such that d -< b ~< a and d -< c -< a. The set of 
compound recovery actions is thus A = {{a}, {&}, {c}, {b, c}, {d}}; the ordering relation is 
pictured in 7, together with action costs. 

BuildTemporalTree is first called on the whole te-set. None of the two terminat- 
ing conditions is met (notice however that there are two observations that are not use- 
ful, since they do not discriminate: (53, 0} and (53,1)). Then the main function calls 
ID3ChooseSafeObs and consequently FindSafeObs. Since the global deadline is 2 we 
must check time labels 0, 1 and 2, starting from the last one. 

Exploiting only observations with time label 2 we obtain the following partition: 

{{siti, sit 6 }, {sit 2 , sit 5 , sit 7 , sit 8 }, {sit 3 }, {sit 4 }} 

However in order to find the expected cost we still have to check if for some partition block 
the deadline has changed; this happens for {siti, sitg} as well as for {sits} and {sit4}. For 
the last two blocks it does not change anything - they already contain only one element. As 
to the first block, the deadline is now 5 and thus it is possible to further split the partition. 
Therefore we obtain that the partition for time label 2 is: 

P t=2 = {{siti}, {sit 6 }, {sit 2 , sit 5 , sit 7 , sit 8 }, {sit 3 }, {sit 4 }} 
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After finding the partition, the algorithm computes the expected cost, which turns out 
to be: 

X E ,t=2 = x(Act(siti)) • 1 + x(Act(sit 6 )) • 1 + x(Act({sit 2 , sit 5 , sit 7 , sit 8 })) • 1 

+ x(Act(sits)) • I + x(Act(sit 4 )) • 1 

= 100.1 + 10.1 + 70.1 + 20.1 + 50.1 
= 57.5 

Then the algorithm moves to time label 1; starting from Pf=2 it adds observations with 
time label 1, obtaining a new partition: 

P*=i = {{siti}, {sit 6 }, {sit 2 , sit 5 }, {sit 7 }, {sit 8 }, {sit 3 }, {sit 4 }} 

Deadlines move for {sit-?} and {sitg}, but since these are singletons the new observations 
cannot further split the partition. The expected cost is now: 

X E)t =i = x(Act(siti)) • - + x(Act(sit 6 )) • - + x(Act({sit 2 , sit 5 })) • - + x(Act(sit 7 )) • - 
+ x (Act(sit 8 )) • 1 + x(Act(sit 3 )) • 1 + x(Act(sit 4 )) • 1 

= 100 • 1 + 10 • 1 + 70 • 1 + 20 • 1 + +50 • 1 + 20 • 1 + 50 • 1 

8 8 4 8 8 8 8 

= 48.75 

Since XE,t=i < ^E,t=2 we can conclude that observations with time label 2 are not safe. We 
now move to time label 0, and we immediately realize that the new observations do not 
change the partition. Thus XE,t=o = ^E,t=i, and safe observations are those with time label 
equal either to or to 1. 

The algorithm now calls function ID3ChooseTest which selects the observation with 
minimum entropy. Figure 13 shows the entropies of the different observations at this stage, 
from which we deduce that the best choice is (s2, 1). 



Entropies for {siti, sit2, sit 3 , sit4, sits, sit 6 , sit7, sit 8 } 


(«i,0) 


1.5 




1.5 




1.451 


(S2,l) 


0.844 



Figure 13: Entropies for safe observations at the initial call 

Figure 15. (a) shows the tree at this point; function BuildTemporalTree recursively 
invokes itself four times, yielding: 

• a call ci on E u = {siti, site}; 

• a call c 2 on E n = {sit2,sits}; 

• a call C3 on E| = {sit3, sit 4 , sit 7 }; 

• a call c 4 on Eh = {sitg}. 
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Let us focus on call c±: again, none of the terminating conditions is met, therefore the 
algorithm invokes ID3ChooseSafeObs and thus FindSafeObs. Notice however that on 
this subset only a few observations are in UsefulObs: (si,3), (s2,3), (s2,4), (s2,5) and 
(s3,5). The global deadline is 5. 

First we find the partition (and the expected cost) for time label 5: 

P t=5 = {{siti}, {sit 6 }} 

X Ev , t =5 = x(Act(siti)) • \ + X (Act(sit 6 )) • 1 = 100 ■ 1 + 10 • 1 = 55 

No additional observations can split further this partition and lower the cost; therefore we 
find that all valid observations are also safe. It is moreover obvious that all these observa- 
tions have the same entropy, which is 0. Therefore the algorithm can non-deterministically 
select one of them; a reasonable criterion would be to select any of the earliest ones, for 
example (si,3). 

Since the initial te-set for call c\ is now split in two, there are two more recursive calls. 
However we can notice that if BuildTemporalTree is called on a te-set with a single 
element, the first terminating condition is trivially met (all the fault situations have the 
same recovery action). The function simply returns a tree leaf with the name of the proper 
recovery action. Figure 15. (b) shows the tree after c\ has been completed. 

Now let us examine C2- the algorithm eliminates non-discriminating observations, and 
finds out that the set of useful observations is empty. Thus it builds a leaf with recovery 
action {b, c}. Let us pass to call C3. In this case none of the terminating conditions is met: 



Entropies for {sit3, sit4, sit7} 




0.667 


(si, 2) 


0.667 


(ai,3) 


0.667 


(S2,2) 


0.667 


{82,3) 


0.667 


<S2,4} 


0.667 


(S2,5) 





(S3,l) 





(as, 2) 





(S3, 3) 





(S3, 4) 










Figure 14: Entropies for safe observations at call C3 

the algorithm must then look for safe observations. The global deadline is 5, so we start 
examining time label 5, and we find: 

Pt =5 = {{sit 3 },{sit 4 },{sit 7 }} 

X Eht=5 = x (Act(sit 3 )) • - + x(Act(sit 4 )) • - + x(Act(sit 7 )) • - 

= 20 • - + 50 • - + 20 • - = 30 

3 3 3 

Much as happened for c±, no additional observation can further split the partition, so we 
can conclude that all valid observations are also safe. Figure 14 shows entropy for all valid 
observations; the earliest one with minimum entropy is (53, 2) and this the algorithm selects. 
The two recursive sub-calls that are generated immediately terminate: {sit 4 } is a singleton, 
and in {sit3,sity} both fault situations correspond to the same recovery action. 

The last recursive call, c 4 , has in input a singleton and thus immediately terminates. 
The final decision tree T is pictured in Figure 15. (c). 
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Figure 15: The output tree at different stages, (c) shows the final tree. 



Let us check if the expected cost of T is really equal to the expected cost for E. Figure 16 
shows for each tree leaf I the corresponding set of fault situations examples(7), its probability 
P (exam pies (7); E) and its cost Leaves are numbered from 1 to 6 going left to right 

in Figure 15. (c). 
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Figure 16: Fault situations, probabilities and costs for the leaves of the tree in Figure 15. (c) 



502 



Temporal Decision Trees: Model-based Diagnosis of Dynamic Systems On-Board 



Thus the expected cost of the tree is: 

6 



X e ,a(T) = J]x(>Cft))-P(examples(Z);E) 



i=i 

= - • 100 + - • 10 + \ ■ 70 + - • 50 + \ ■ 20 + - ■ 50 

8 8 4 8 4 8 

= 48.75 

If we look back at example 8 we see that Xe,a = 48.75, thus T has the minimum possible 
expected cost. Moreover, we can compare T with the tree Ti of example 5. Also Ti has 
the minimum possible expected cost, but T is more compact. 



7. Conclusions 

In this paper we introduced a new notion of diagnostic decision tree that takes into account 
temporal information on the observations and temporal constraints on the recovery actions 
to be performed. In this way we can take advantage of the discriminatory power that is 
available in the model of a dynamic system. We presented an algorithm that generates 
temporal diagnostic decision trees from a set of examples, discussing also how an optimal 
tree can be generated. 

The automatic compilation of decision trees seems to be a promising approach for recon- 
ciling the advantages of model-based reasoning and the constraints imposed by the on-board 
hardware and software environment. It is worth noting that this is not only true in the 
automotive domain and indeed the idea of compiling diagnostic rules from a model has been 
investigated also in other approaches (see e.g., Darwiche, 1999; Dvorak & Kuipers, 1989). 
Darwiche (1999), in particular, discusses how rules can be generated for those platforms 
where constrained resources do not allow a direct use of a model-based diagnostic system. 

What is new in our approach is the possibility of compiling also information concerning 
the system temporal behaviour, obtaining in this way more accurate decision procedures. 

To the best of our knowledge, temporal decision trees are a new notion in the diagnostic 
literature. However, there are works in other fields that have some relation to ours, since 
they are aimed at learnig rules or associations that take into account time. 

Geurts and Whenkel (1998) propose a notion of temporal tree to be used for early 
prediction of faults. This topic is closely related to diagnosis, albeit different in some 
ways: the idea is that the device under examination has not failed yet, but by observing 
its behaviour it is possible to predict that a fault is about to occur. Geurts and Wehenkel 
propose to learn the relation between observed behavioural patterns and consequent failures 
by inducing a temporal tree. 

The notion of temporal tree introduced by Geurts and Wehenkel is different than our 
temporal decision trees, reflecting the different purpose it has been introduced for. Rather 
than sensor readings, it consider a more general notion of test, and the tree does not 
specifies the time to wait before performing the tests, but rather the agent running the tree 
is supposed to wait until one of the tests associated to a tree node becomes true. 

Also the notion of optimality is quite different: in the situation described by Geurts and 
Wehenkel the size of the resulting tree is not a concern. The tree-building algorithms aims 
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then at minimizing the time at which the final decision is taken. In our algorithm, size is 
the primary concern, while from the point of view of time it suffices that diagnosis is carried 
out within certain deadlines. From the point of view of time alone, the apporach by Geurts 
and Wehenkel is probably more general than ours; the problem of considering the trade-off 
between diagnostic capability and time needed for diagnosis is one of the major extensions 
we are considering for future work on this topic (see below). 

Finally, the algorithm proposed by Geurts and Wehenkel works in a quite different 
way than ours: it first builds the tree greedily, using an evaluation function that weighs 
discriminability power agains time needed to reach a result, and selecting at each step the 
texts that optimizes such function. Then it prunes the tree in order to avoid overfitting. On 
the other hand, our approach aim at optimizing the tree from the point of view of cost, and 
at the same time tries to keep the tree small with the entropy heuristic. We think that, since 
optimization can be carried out at no additional cost 9 with respect to the minimization of 
entropy, our approach can obtain better results, at least in those cases where one can define 
a notion of deadline. 

The process of learning association rules involving time has also been studied in other 
areas, such as machine learning (see for example Bischof & Caelli, 2001, where the authors 
propose a technique to learn movements) and data mining. While the specific diagnostic 
tailoring of our approach makes it difficult to compare it with more generic learning al- 
gorithms, the connections with data mining may be stronger. Our proposal in fact aims 
essentially at extracting from series of observations those patterns in time that allow to 
correctly diagnose a fault: this process can be regarded as a form of temporal classification. 
A preliminary investigation of papers in this area (see Antunes & Oliveira, 2001 for an 
overview) seems to suggest that, whereas the analysis of temporal sequences of data has 
received much interest in the last years, not much work has been done in the direction of 
data classification, where temporal decision trees could be exploited. 

This suggests an interesting development for our work, in particular as concerns its 
applicability in other areas. However, we believe that the algorithm we presented needs to 
be extended in order to be exploited in other contexts. In particular we are investigating 
the following extensions: 

• Deadlines could be turned from hard to soft. Soft deadlines do not have to be met, 
but rather define a cost associated to not meeting them. Thus not meeting a deadline 
becomes an option that can be taken into account when it is less expensive than 
performing a recovery action when the diagnosis is not complete. One could even 
define a cost that increases as the time passes from the expiration of the deadline. 
Such an extension would allow to model also the trade-off between discriminability 
power and time needed by the decision process, which we believe is the key to making 
our work applicable in other areas. 

• Actions could be assumed to have a different cost depending on the fault situation; for 
example the action associated to a fault could become dangerous and thus extremely 
expensive if performed in presence of another fault. 

9. From the point of view of asymptotical complexity. 



504 



Temporal Decision Trees: Model-based Diagnosis of Dynamic Systems On-Board 



On the long term, future work on this topic will be aimed at widening its areas of 
applicability, and investigating in deeper details its connections with other fields, such as 
fault prevention and data mining. 
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Appendix A. Proofs 

This section contains the proofs of all propositions, lemmas and theorems in the paper. 

Proposition 12. Let T = (r, N, E, C, T) be a temporal decision tree compatible with 
a te-set E. Let li, ...,// G N denote the leaves ofT. Then examples(Zi), . . . , examples(//) 

is a partition o/E. 

Proof. Follows immediately by the definition of examples (10), by noticing that if 
ni,...,rik are the children of p then {examples(rii), . . . , examples(nfc)} is a partition of 
examples(p). o 

Proposition 15 Let T = (r, N, E, C, T) denote a temporal decision tree, and let 
l±, . . . , l u be its leaves. Then 



Proof. By induction on the depth of T. If T has depth then it consists of a single 
leaf I and 10 holds trivially since examples(Z) must be equal to E and P(E;E) = 1. 

If T has depth > then let Ti, . . . , denote its direct subtrees and c±, . . . ,c& denote 
their roots. We can regard each Tj as an autonomous temporal decision tree compatible 
with te-set Ej = examples(cj). By induction hypothesis we have that: 



u 



*e,a(T) =£xW • P(examples(Z);E) 



i=i 



(13) 




l leaf of T, 



I leaf of T, 




P(examples(/);E) 

%E) 



Moreover by definition of expected cost: 



k 



(14) * e ,a(T) = Y, p ( c ( r ) - £((r, a))) ■ X^A^i) with 



1=1 



P(£(r) £((r, a))) = P(examples(cj); examples(r)) = P(E i5 E). 
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From (13) and (14) we thus obtain: 

P(examples(Z); 



(15) * e ,a(t) = ^ y, nw)-x(m) 



P(E i; E) 

i=ineafofTj v ' ' 

k 



Y E x(AO)--P(examples(0;E) 



i=l l leaf of Tj 

Since the leaves of T are all and only the leaves of Ti, . . . , (15) is equivalent to the 
thesis. o 

Proposition 16 Let T = (r T , N T , E T , C T ,T T ) , U = (r v , N v , E v , C v , T v ) be two 
temporal decision trees compatible with the same te-set E and the same actions model A. If 
T is more discriminating than U then <^e,a(T) < Afe a(U). 

Proof. Rewriting equation (10) we obtain: 

r 

(16) * EiA (T) = ^x(£t(!«)) • P(examples(Z);E) = ^ x(^ T (leaf T (sit)))P(sit; E) 

i=l siteE 

(17) * E)A (U) = J] x(^u(leafu(sit)))P(sit;E). 

siteE 

Since T is more discriminating than U, we have that for all sit G E: 

£ T (leaf T (sit)) -< £u('eafu(sit)) or ^T(leaf T (sit)) = £u('eafu(sit)) 
with at least one sit satisfying the first relation. By definition of x it follows that for all sit: 

x (£ T (leaf T (sit))) < x (Aj(leafu(sit))) 

and for at least one sit: 

X (£ T (leafr(sit))) = x (Aj (leaf u (sit))) 

Therefore if we compare the individual elements of the two sums in (16) and (17) we observe 
there exists at least one sit for which: 

x(4r(leaf T (sit)))P(sit;E) < x (Aj(leafu(sit)))P(sit;E) 

and for all other sit 

x(M'eaf T (sit)))P(sit;E) < x (£ u (leaf u (sit)))P(sit; E) 

which concludes the proof. o 
Theorem 20 Let E be a te-set with actions model A. We have that: 

(i) There exists a decision tree T compatible with E such that «Ye,a(T) = %e,a- 

(ii) For every temporal decision tree T compatible with E, .V ..a < <^e,a(T). o 
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In order to prove this theorem we introduce some lemmas. 

Lemma 26 Let T be a temporal decision tree compatible with a te-set E. Then sitj « sitj 
implies leafr(sitj) = leafr(sitj). 

Proof. We prove that sitj ~ sitj implies leaf t (sitj) = leaf t (sitj), from which the 
lemma easily follows. Let us suppose that leafr(sitj) / leaf t (sitj). This means that 
there is a common ancestor n of the two leaves such that sitj, sitj € examples(n) and 
Val(sit ; , (£(n), T(n))) / Val(sitj, (£(n),T(n)}). Since sitj ~ sitj this is possible only if 
T(n) > min{DI(sitj), Dl(sitj)}. But since T is compatible with E it must hold that T(n) < 
Dl(examples(n)) < min{DI(sitj), Dl(sitj)}, which contradicts the previous statement. O 

Lemma 27 Let E be a te-set with sensors s\, . . . , s m , time labels t\, . . . , tiast and actions 
model A. There exists a temporal decision tree T = (r, N, E, C,T) such that Ae,a(T) = 
Xe,a- 

Proof. In order to prove the thesis we construct a tree T with the same expected cost 
as the te-set. 

Let us define a total order on observations in E as follows: (s, t) < (s f , t'} if either t < t' 
or t = t' and s precedes s' in a lexicographic ordering. Let us denote by o\ , . . . , o max the 
ordered sequence of observations thus obtained. We shall define T level by level (starting 
from the root, at level 1) giving the value of C and T for nodes at level h. 

T has a maximum of max + 1 levels, where max is the number of observations. New 
levels are added until all nodes in a level are leaves (which as we shall see happens at most 
at level max + 1). Let thus n be a node at level h , and let (si h ,ti h ) = Oh if h < max. We 
have: 

J a leaf if h = max + 1, or Dl(examples(n)) < ti h ; 

1 an internal node otherwise. 

J merge({Act(sit [ sit e examples(n)}) if n is a leaf; 
1 Si h if n is an internal node. 

ti h if n is an internal node. 

A decision-making agent running such a tree would essentially take into account all sensor 
measurement at all time labels until either there are no more available observations or it 
must perform a recovery action because a deadline is about to expire. 
Now we need to show that A5e,a(T) = ^e,a- 

Let li,...,l u denote the leaves of T. We shall first of all prove that sitj ~ sitj if and 
only if leaf^(sitj) = leafijr(sitj ) , or equivalently that 

{examples(Zi), . . . , examples(Z u )} = E/«. 

This, together with equations (10) and (11) yields the thesis. 

We already know from lemma 26 that sitj w sitj implies leaf^sitj) = leaf^sitj); we 
need to show that the opposite is also true. Let us thus assume that sitj, sitj € examples(Z) 



n is 

C(n) = 
T(n) = 
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for some I G {Zi, . . . , l u }. Let r = «i, n2, . . . , nn, nn+i = I be the path from the root to 
/. We know from the definition of T that for all h < H, (£(n^), T(n^)} = Oh, and that 
oi,...,oh are all observations (s,t) of E such that t < Dl(examples(7)). Moreover since 
sitj, sitj G examples(7) we have that for all h = 1, . . . , H, Val(sitj, o/J = Val(sitj, oh)- 

Now there are two possibilities: either Dl(examples(7)) = min{DI(sitj), Dl(sitj)}, or 
DI(examples(Z)) < min{DI(sitj), Dl(sitj)}. 

In the first case we immediately obtain that sitj ~ sitj and thus sitj ~ sit ^ . 

In the second case, there must be sit^ G examples(7) such that Dl(examples(7)) = 
Dl(sit fe ). Moreover, Dl(sit fc ) = min{DI(sitj), Dl(sit fc )} = min{DI(sitj), Dl(sit fe )}. Since all 
considerations above apply also to sit^ we thus have that sitj « sit^ and sit^ rs sit 7 ; therefore 
by transitivity sitj ss sitj. o 

Lemma 28 Let T = (r, N, E, C, T) be a decision tree compatible with a te-set E with 
actions model A. Then Xe,a < ^e,a(^)- 

Proof. Let T be as defined in the proof of lemma 27. In order to prove the thesis it 
suffices to show that T is either equally 10 or more discriminating than T (see proposition 
16). Actually we shall show that given sit G E either £(leafijr(sit)) -< £(leafr(sit)) or 
Z(leaf T (sit)) = £(leaf T (sit)). 

We know that examples(leafcjr(sit)) C examples(leafT(sit)). In fact, let sit' be an 
element of examples(leaf7jr(sit)) different from sit itself: by construction of T we have that 
sit w sit', and by lemma 26 it follows that leafr(sit) = leafr(sit'). 

Let: 

A = {Act(s) | s £ examples(leaf7p(sit))}, A = {Act(s) | s G examples(leaf T (sit))}. 

Since A C A, by definition of merge: 

merge(^4) -< merge(A) or merge(yl) = merge(74) 

Thus having £(leafip(sit)) = merge(yl) and £(leafx(sit)) = merge(yl) we obtain that either 
the action selected by T is weaker than that selected by T, or it is the same. o 
Now we can prove theorem 20. 

Proof. Point (i) is proved by lemma 27, while point (ii) corresponds to lemma 28. o 
Proposition 21 Let us consider an execution of BuildTemporalTree starting with 
a main call cq. The initial te-set, which we want to build a tree over, is E = E CQ with 
A = [[ActModel]] Co . For any recursive call c, let us denote by E* the te-set determined by 
[[Examples]] c and [[Obs_Update]] c . Then: 

(1) ^e,a([[T]] C() )>^e,a 

(2) <Ye,a([[T]]co) = -V a if and only if for every non terminal 11 recursive call c generated 
by co it holds that ^e c ,a = <^e*,a 

10. Rather intuitively, two trees are equally discriminating if they associate to each fault situation the same 
recovery action. 

11. We exclude terminal calls because they do not even compute ObsJJpdate. 
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Proof. We shall prove (1) and (2) for every recursive call c (rather than only for co). 
The proof is by induction on the depth of the recursion starting from c. 

depth = 0. Then c is terminal, and we only have to prove that ^([Ty = Xe,a- There 
are two reasons why c may be terminal: either (i) all fault situations in [[Examples]] c 
are associated with the same recovery action A, or (%%) [[Valid0bs]] c = 0. 

(i) Prom definition 19 we have: 

*e,a = Yl x(merge({Act(sit) | sit e r?})) • P(r/;E C ) 

??eE c /« 

Since [[T]] c is made of a single leaf / with £(/) = Awe also have that ^e c ,a([[T]] c ) = 
x(A), which proves the thesis. 

(ii) If [[ValidObs]] c = then for all (s,t) € [[Examples]] c , t > DI([[Examples]] c ). 
Let sit £ E c be such that Dl(sit) = DI([[Examples]] c ). Then by definition of 
indistinguishability for any sit' G E c we have that sit ~ sit'. This proves that 
E c /« is made of a single equivalence class which coincides with E c itself. Thus 
%e c ,a = x( mer g e ({Act(sit) | sit 6 E c })). Since [[T]] c is made of a single leaf I 
with C(l) = merge({Act(sit) | sit G E c }), it follows that A]e ci a([[T]] c ) = Ae c ,a- 

depth > 0. Then c is not terminal and ChooseObs selects an observation o = (s,t). 
Let vi,...,Vk be the possible values for o: then c has k inner recursive calls to 
BuildTemporalTr.ee, which we shall denote respectively by ci,...,Cfc. We have 
that {E C1 , . . . , E Cfc } is a partition of E*. 

By definition of expected cost (14) we have that: 

k 

*e c ,a([[T]] c ) = ^P(E C | G ^ ;E C ) • * EcUvA ([[T]] Ci ) 
i=i 

^c\ Q ^ v . an d E Ci differ only in the set of observations, which is [[Obs]] c for the former 
and [[Obs_Update]] c for the latter. However we have that: 

• P(E C | Q ;E C ) = P(E Ci ;E c ) since probabilities depend only on the fault situa- 
tions in a te-set, and not on the observations. 

• ^E c | ,A(I T ]] c i) = ^E Ci ,A([[T]] c J: expected cost depends also on the observa- 
tions, but [[T]] Ci by construction can contain as labels only those observations in 
E c .. 

Moreover, since also E c and E* differ only in the observations P(E Ci ; E c ) = P(E Ci ; E*). 
Therefore we can write: 

k 

^ Ec a([[T]] c ) = ^P(E Ci ;E:) • ^ Eci , A ([[T]] c J 
i=i 
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In order to prove (1), we can apply the induction hypothesis <-tE Ci ,A([[T]] Ci ) > <^E Ci ,A) 
and obtain: 

k 

(18) ^e c ,a([[t]] c ) > J2 p (® Ci ;K) -^E Ci , A 

i=\ 

Now let us work on the right-hand side expression in 18: 

k k 

^P(E Ci ;E:)-^ Eci , A = ^P(E Ci ;E*) £ x(Act(r?)) • P(r/;E Ci ) 

i=l i=l r)€E Ci /« 

A; 

= E E x(Act(r ? ))-P(r ? ;E Ci ).P(E c ,;E:) 

= E E x(Actfa))-Pfa;E*) 

Notice however that {E Ci /«} is a partition of E*/«; in other words each rj E E*/ss 
belongs to exactly one set E Ci /~. In fact, splitting examples according to the value 
of one observation cannot split a class of undistinguishable observations. Thus the 
above equality becomes: 

k 

^P(E Ci ;E:)-^ EciiA = £ X (Act(r ? ))-P(r ? ;E*)=^ E; , A 

i=l ryeE*/* 

This, together with 18, yields: 

(19) *E C , A ([[T]] C ) > T, . A 

As mentioned above, the only difference between E* and E c is that the former has 
fewer observations. This implies that, if sit ~ sit' in E c , then sit ~ sit' in E* as well. 
This means that E c /« is a sub-partition 12 of E*/ss in the following sense: we can 
partition every 9 £ E*/« in rj(6) = {rj[, . . . , rj[ k \ such that for each rj'j there exists 
exactly one r]j € E c /« containing exactly the same fault situations as rf'y This yields: 

*E C ,A E x(Act(r ? ))-P(r ? ;E c ) 

Since each rfj has the same fault situations as the corresponding rfj, and necessarily 
for each r)j there is a 9 containing it, we have: 

*E C ,A E E x(Act(»/))-P(»/;E*) 

eeE*/^rj'£ri(8) 

12. E c /« is not a sub-partition of E*/« in the ordinary sense because they do not have the same set of 
observations. 
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If rj G rj(9) the fault situations in rf are a subset of those in 9; thus x(Act(r/)) < 
x(Act(0)). Then we obtain: 

*e c ,a < E E x(Act(0))-P(r/;E*) 

= E x(Act(0)). E p (v';K) 
= E x(Act(0)) • P(0;K) = x Ei ,A 

Together with equation 19, this proves (1): 

<*e c ,a([[T]] c ) > X .. a 

Now let us prove (2). The induction hypothesis changes 18, and thus 19, into equali- 
ties, thus yielding: 

(20) ^e c ,a([[T]] c )=^e*,a 

Since by hypothesis in (2) we have that .V .a = ^e c ,a, we immediately obtain: 

<*E c ,A([[ T ]]e) = X .. .a 



which concludes the proof. o 
Proposition 22 Let c,d denote two independent calls to BuildTemporalTree 
with the same input arguments but with different implementations of ChooseObs. If 
[[tlabel]] c < [tlabel]] d then X e *,a < x m*,A- 

Proof. Follows immediately from [[Dbs_Update]] c C [[Obs.Update]]^. O 
Proposition 23 Let c be a call to BuildTemporalTree. // [[tlabel]] c = i minc = 
min{t | (t,s) € [[Valid0bs]] c } then ,V v-.a < %e c ,a- 

Proof. In this case [[Obs_Update]] c = [[Usef ulDbs]] c , thus the only removed observa- 
tions are non discriminating ones. o 
Proposition 25 For any call c to BuildTemporalTree there exist a time label t maXc 
such that the safe time labels are all and only those t with t m - mc < t < 

tmax c j where t m \„ c is 

as in proposition 23. 

Proof. Straightforward. o 
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